﻿using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;

using System.Runtime.InteropServices;
using System.Runtime.Serialization;
//using System.DirectoryServices;
using System.Management;

namespace XDLogonMonitor {
    class UserInformation {

        private static String WMIPATH = "\\root\\cimv2";
        public UserInformation() {

        }

        public DateTime UserLoginTime(String username, String server) {
            
            String message = "";
            String timeWritten = "";
            
            System.Management.ManagementScope mangeScope = null;
            System.Management.ConnectionOptions connOpt = new System.Management.ConnectionOptions();
            System.Management.SelectQuery sq = new SelectQuery("SELECT * FROM Win32_NTLogEvent WHERE EventCode = 528");

            try {
                mangeScope = new System.Management.ManagementScope("\\\\" + server + WMIPATH);
                mangeScope.Connect();
                ManagementObjectCollection moc = new ManagementObjectSearcher(mangeScope, sq).Get();

                foreach (ManagementObject mo in moc) {
                    if (mo["Message"] != null) {
                        message = (String)mo["Message"];
                    }
                    if (mo["TimeWritten"] != null) {
                        timeWritten = (String)mo["TimeWritten"];
                    }

                    if (message.Contains(username)) break;
                }
            }
            catch (Exception e) {
                Console.Error.WriteLine(e.ToString());
                //Environment.Exit(1);
            }
            return DateTime.MinValue;
        }
    }
}

            

﻿


